mlsanityData to 7 Oct 2026

Salient Conditional Diffusion for Defending Against Backdoor Attacks

arXiv 2301.13862 ↗First posted 31 Jan 2023cs.LG cs.CR cs.CVcited by 7

On the map: Diffusion models → Robustness, privacy and adversarial aspects

also in 1 more
Abstract (arXiv)

We propose a novel algorithm, Salient Conditional Diffusion (Sancdifi), a state-of-the-art defense against backdoor attacks. Sancdifi uses a denoising diffusion probabilistic model (DDPM) to degrade an image with noise and then recover said image using the learned reverse diffusion. Critically, we compute saliency map-based masks to condition our diffusion, allowing for stronger diffusion on the most salient pixels by the DDPM. As a result, Sancdifi is highly effective at diffusing out triggers in data poisoned by backdoor attacks. At the same time, it reliably recovers salient features when applied to clean data. This performance is achieved without requiring access to the model parameters of the Trojan network, meaning Sancdifi operates as a black-box defense.

Key facts. Cited by 7 papers in the map (data through 7 Oct 2026). Placed in Robustness, privacy and adversarial aspects, one of 14 directions in Diffusion models. Builds on 31 of its 43 references that are in the map. First posted on arXiv 31 Jan 2023.

Builds on

31 of 43 references.

Closest ancestors · 3

Same direction, newest first

  1. 2022How to Backdoor Diffusion Models?11 Dec
  2. 2022Guided Diffusion Model for Adversarial Purification from Random Noise22 Jun
  3. 2022Diffusion Models for Adversarial Purification16 May

Other references · 28

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 29,915
  3. 2020Denoising Diffusion Probabilistic Modelscited by 20,851
  4. 2021High-Resolution Image Synthesis with Latent Diffusion Modelscited by 18,694
  5. 2020Denoising Diffusion Implicit Modelscited by 9,655
  6. 2021Diffusion Models Beat GANs on Image Synthesiscited by 8,185
  7. 2016Grad-CAM: Visual Explanations from Deep Networks via Gradient-based Localizationcited by 6,690
  8. 2019EfficientNet: Rethinking Model Scaling for Convolutional Neural Networkscited by 6,415
  9. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  10. 2022Generative Adversarial Networkscited by 5,603
  11. 2021Improved Denoising Diffusion Probabilistic Modelscited by 3,736
  12. 2021Image Super-Resolution via Iterative Refinementcited by 1,506
16 more
  1. 2022RePaint: Inpainting using Denoising Diffusion Probabilistic Modelscited by 1,419
  2. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,324
  3. 2021Variational Diffusion Modelscited by 1,145
  4. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
  5. 2018RISE: Randomized Input Sampling for Explanation of Black-box Modelscited by 825
  6. 2018Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networkscited by 550
  7. 2020Backdoor Learning: A Surveycited by 412
  8. 2021Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networkscited by 313
  9. 2022Sketch-Guided Text-to-Image Diffusion Modelscited by 180
  10. 2021Rethinking the Backdoor Attacks' Triggers: A Frequency Perspectivecited by 155
  11. 2018SentiNet: Detecting Localized Universal Attacks Against Deep Learning Systemscited by 148
  12. 2020Practical Detection of Trojan Neural Networks: Data-Limited and Data-Free Casescited by 93
  13. 2021Backdoor Attack in the Physical Worldcited by 82
  14. 2020TrojanZoo: Towards Unified, Holistic, and Practical Evaluation of Neural Backdoorscited by 30
  15. 2019Februus: Input Purification Defense Against Trojan Attacks on Deep Neural Network Systemscited by 26
  16. 2021Deep Saliency Prior for Reducing Visual Distractioncited by 17

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 3; 2024: 0; 2025: 3; 2026: 1.

7 papers.

  1. 2025REFINE: Inversion-Free Backdoor Defense via Model Reprogrammingcited by 20
  2. 2023Unlearnable Examples Give a False Sense of Security: Piercing through Unexploitable Data with Learnable Examplescited by 17
  3. 2023From Trojan Horses to Castle Walls: Unveiling Bilateral Data Poisoning Effects in Diffusion Modelscited by 9
  4. 2023Pick your Poison: Undetectability versus Robustness in Data Poisoning Attackscited by 1
  5. 2025Adversarially Robust AI-Generated Image Detection for Free: An Information Theoretic Perspectivecited by 1
  6. 2025Towards Size-invariant Salient Object Detection: A Generic Evaluation and Optimization Approachcited by 0
  7. 2026Kill it with FIRE: On Leveraging Latent Space Directions for Runtime Backdoor Mitigation in Deep Neural Networkscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2024TERD: A Unified Framework for Safeguarding Diffusion Models Against Backdoors
  2. 2025A Dual-Purpose Framework for Backdoor Defense and Backdoor Amplification in Diffusion Models
  3. 2024Invisible Backdoor Attacks on Diffusion Models
  4. 2024PureDiffusion: Using Backdoor to Counter Backdoor in Generative Diffusion Models
  5. 2024Watch the Watcher! Backdoor Attacks on Security-Enhancing Diffusion Models
  6. 2024DisDet: Exploring Detectability of Backdoor Attack on Diffusion Models
  7. 2026TEMPO-Diffusion: Temporally Exposed Malicious Poisoning of Diffusion Models
  8. 2025Backdoor Defense in Diffusion Models via Spatial Attention Unlearning